最新のセキュリティ情報
2 ページ目
10月20日(火)
Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress
影響: go:github.com/klauspost/compress <= 1.18.6 → 1.18.7 Signed Integer Overflow in s2.NewDict Summary A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. Package - Name: github.com/klauspost/compress/s2 - Ecosystem: Go - Affected ve…
Crass : Large numeric exponents cause CPU and memory denial of service
影響: rubygems:crass < 1.0.7 → 1.0.7 Impact Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash. Patches This is fixed in Crass 1.0.7. Related - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml
Studioへの不正アクセスについてまとめてみた
2026年10月16日、ノーコードのWebサイト制作サービス「Studio」を運営するStudioは、同社が利用するクラウド環境への第三者による不正アクセスにより、登録している顧客の情報が外部に流出した可能性があると公表しました。ここでは関連する情報をまとめます。 社内調査で発覚 Studioは、第三者がStudioの一部機能の脆弱性を悪用して同社のクラウド環境に不正にアクセスし、環境内のデータを外部から取得できる状態にしていたと公表した。この状態は10月14日にStudioが対処するまで続いていた。現時点で確認できている不正アクセスの期間は9月30日から10月1日(日本時間)。実際に第三者に…
Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns
Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight intermediate certificate authority keys. Programs built on the new release will refuse connections to sites and services whose certificates were issued under those keys. The Go team says the keys belong to one certificate authority it has not
NECの委託先にサイバー攻撃 正規アカウント悪用し顧客のサーバ暗号化、個人情報の漏えいも
NECは10月20日、システム開発・保守業務の委託先が9月下旬にサイバー攻撃を受け、その影響でNECの顧客に不正アクセスや情報漏えいの被害が出たと発表した。漏えいした情報には個人情報も含まれるという。
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the
気象庁の緊急地震速報の過大推定についてまとめてみた
2026年10月16日、気象庁は同日に北海道から中部地方へ発表した緊急地震速報(警報)について、マグニチュードを過大に推定したことによるものと公表しました。ここでは関連する情報をまとめます。 M6.9の地震がM9.9と推定され警報に 10月16日12時38分頃、カムチャツカ半島付近でM6.9(速報値)の地震が発生し、観測された最大震度は函館市の震度1だった。(出典: 2)緊急地震速報は12時38分27.7秒の第1報でM6.2と推定し、第14報(12時39分04.0秒)まではM6〜7台で推移した。12時39分23.6秒の第15報でM9.9となり、12時40分02.6秒の第17報で警報を発表した。…
[悪用確認] CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability
Siemens Software Center Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-11-03)
[悪用確認] CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-11-03)
[悪用確認] CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Plex Media Server Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-23)
[悪用確認] CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-11-03)
[悪用確認] CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability
Plex Media Server Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-23)
[悪用確認] CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
EG Secure Solutions SiteGuard Server Edition EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-23)
ソースネクストへの不正アクセスについてまとめてみた
2026年10月15日、ソースネクストは、同社が管理する会員情報に対する第三者の不正アクセスで、会員の個人情報が外部に流出したことが判明したと公表しました。ここでは関連する情報をまとめます。 会員情報取得APIの不正利用 第三者は2026年10月9日10時頃から、会員情報取得APIを不正に利用して会員情報を取得していた(出典: 3)。10月13日9時頃、社員が会員情報を管理するシステムへの不正アクセスを見つけ、ソースネクストは外部からの不正な通信を遮断するなどの緊急措置を講じて13時36分までに封じ込めを完了した(出典: 3, 5)。以後、不正アクセスは確認されていないとしている(出典: 3)…
aiohttp server lacks an initial request/header timeout
影響: pip:aiohttp <= 3.14.3 → 3.14.4 Summary The keepalive timeout was not used during the initial portion of a request. Impact An attacker could keep an idle connection open indefinitely before sending any data. Workaround Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
影響: pip:aiohttp <= 3.14.3 → 3.14.4 Summary Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests. Impact An attacker could cause resource exhaustion through specially crafted requests.
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
影響: pip:mercury >= 3.0.0, <= 3.2.3 → 3.2.4 Summary A missing comma in mercury_app/block_handler.py's BLOCKED_PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury. Details The blocklist in mercury_app/block_handler.py is defined as: BLOCKED_PATTERNS = [ # JupyterLab UI + API r"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.)?" r"/api/terminals(?:/.)?", r"/api/shutdown(?:/…
Mercury: Unauthenticated Remote Code Execution via /api/kernels
影響: pip:mercury <= 3.2.5 → 3.2.6 Mercury runs a JupyterLab server with anonymous access by default (mercury_app/__main__.py sets --IdentityProvider.token='' when no --token/MERCURY_TOKEN is given; when tokenless it also sets --ServerApp.disable_check_xsrf=True). It relies on a blocklist (mercury_app/block_handler.py BLOCKED_PATTERNS: /lab, /api/terminals, /api/shutdown, /files) to keep anonymous users off dangerous Jupyter endpoints. The vulnerability /api/kernels is NOT in the blocklist (and cannot be — Mercury needs kernels…
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
影響: pip:loopx >= 0.0.1, < 0.4.5 → 0.4.5 Summary loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of Markdown files inside every registered goal repo, using a plain fetch() with no user interaction. The write endpoints are not affected — they are correctly Origin-checked. This report is strictly about…
10月19日(月)
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done. This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were
「Fortinet」「BeyondTrust」の脆弱性悪用に注意喚起 - 米当局
米当局は、Fortinet製品やBeyondTrust製品に関する脆弱性2件が悪用されているとして、注意喚起を行った。
10月17日(土)
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
影響: go:github.com/getarcaneapp/arcane/backend/v2 < 2.6.0 → 2.6.0 Summary A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by RequireGlobalAdmin, users:update is intended to sit BELOW admin (profile management); this finding defeats that separation. Root Cause UpdateUser (handler backen…
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
影響: pip:lmcache >= 0.3.9, < 0.5.6 → 0.5.6 Summary LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport Details LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. The intended clients are sibling LMCache processes. There is no CURVE, ZAP, password, or message authentication on that socket. LMCache used only inside a vLLM process does not open this port. The transp…
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
影響: go:github.com/getkin/kin-openapi <= 0.145.0 → 0.146.0 Summary ValidateResponse panics on a nil pointer when a spec declares a response header with content instead of schema. doc.Validate() accepts that document, so the crash comes from a spec the library just called valid. Same class as GHSA-jpcw-4wr7-c3vq, which covered the request-parameter case in v0.144.0; this is the response-header path. Affects github.com/getkin/kin-openapi 0 { Two things I checked rather than assumed. The response does not need to carry the header; declaring it is enough,…
lopdf has a stack overflow via deeply nested PDF objects
影響: rust:lopdf < 0.42.0 → 0.42.0 lopdf::Document::load_mem (and the other load entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT. Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting i…
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
影響: maven:org.bytedeco:javacv < 1.5.14 → 1.5.14 Summary IPCameraFrameGrabber parses the Content-Length value from the multipart MJPEG HTTP stream returned by the configured IP camera without any bounds checking. A malicious or compromised camera endpoint - or any network attacker able to tamper with the plaintext HTTP response (these streams are conventionally accessed over http://, as documented in the class itself) - can supply a Content-Length value in the range 1073741825-2147483647. This drives the internal buffer-growth routine ensureB…
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
影響: pip:claude-agent-sdk < 0.2.121 → 0.2.121 The Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag. An attacker who controlled the resume value could inject an --mcp-config flag defining a stdio MCP server, resulting in arbitrary command execution at CLI startup that bypassed the SDK's permission controls. Exploitation required an application to pass untrusted input as the session ID to resume. Users are advised to update to…
gomarkdown/markdown IsSafeURL panics on short URLs
影響: go:github.com/gomarkdown/markdown < 0.0.0-20260724235538-61af6e1e6971 → 0.0.0-20260724235538-61af6e1e6971 Summary IsSafeURL slices url[:nPath] before checking that len(url) >= nPath, so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination, giving an unrecoverable crash DoS. Confirmed at HEAD (e08cff8; present since 2022). The defect parser/parser.go, IsSafeURL: go func IsSafeURL(url []byte) bool { nLink := len(url) for _, path :=…
10月16日(金)
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a
[悪用確認] CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerability
Fortinet Multiple Products FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-19)
[悪用確認] CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
BeyondTrust Remote Support BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-19)
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape, is in the Linux kernel's networking code, not in any one cloud's setup, so it reaches the shared
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
影響: npm:@tanstack/start-server-core >= 1.143.12, < 1.169.39 → 1.169.39, npm:@tanstack/react-start >= 1.143.12, < 1.168.60 → 1.168.60, npm:@tanstack/solid-start >= 1.143.12, < 1.168.57 → 1.168.57, npm:@tanstack/vue-start >= 1.143.12, < 1.168.56 → 1.168.56 Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority. Cause The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields. A malfo…
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
影響: go:github.com/containers/podman >= 4.4.0, < 5.8.8 → 5.8.8, go:go.podman.io/podman/v6 >= 6.0.0, < 6.1.3 → 6.1.3 Impact Podman v4.4.0 added a feature where container checkpoints (from the podman container checkpoint command) could be distributed via OCI registry, and pulled from that registry and run via the podman run command. This allowed easy transfer of checkpoints between systems. However, checkpoints allow complete control of how the container is created - including full control of the container sandbox. When podman run detects a checkpoint, it will silently ignore all user input regarding how the c…
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
影響: npm:@anthropic-ai/claude-code < 2.1.179 → 2.1.179 The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned 40-character SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed commit, resulting in attacker-controlled code being installed bypassing the pinned hash.…
Qwik: Crashing any Qwik Server via Resource thenable
影響: npm:@builder.io/qwik < 1.20.0 → 1.20.0, npm:@qwik.dev/core < 2.0.0-beta37 → 2.0.0-beta37 Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolve(resource._resolved). If _resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy. Impact One unauthenticated request crashes the server. Looping keeps every replica dead a…
containerd CRI plugin: Checkpoint restore bypasses destination security context
影響: go:github.com/containerd/containerd/v2 >= 2.1.0, < 2.2.7 → 2.2.7, go:github.com/containerd/containerd/v2 >= 2.3.0, < 2.3.4 → 2.3.4 Impact A vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint via the CreateContainer API to bypass the destination security context and execute with elevated privileges. When restoring a container from a checkpoint archive or annotated OCI image, CRIU restores process credentials, Linux capabilities, no_new_privs, and seccomp state directly from checkpoint data rather than enforcing the destination CRI ContainerConfig. An attacker who can ru…
kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
影響: go:github.com/getkin/kin-openapi >= 0.136.0, < 0.149.0 → 0.149.0 Summary The fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference that occurs when an OpenAPI 3.1 array schema omits the items keyword (which is legal under JSON Schema 2020-12). That fix patched three decoder paths: the standalone parseArray function, the top-level array check in UrlencodedBodyDecoder, and MultipartBodyDecoder. Three additional crash paths were missed. All of them reach the unguarded urlValuesDecoder.parseArray method (openapi3filter/req_resp_decoder.go:576) or the u…
10月15日(木)
相次ぐサイバー攻撃に「AI悪用の可能性」……初来日のAnthropic共同創業者が言及 悪用どう抑止
「おそらく、AIツールが使われている可能性はあるだろうと推測している」──米Anthropicの共同創業者のジャック・クラーク氏が初来日し、同社の日本法人が10月14日に開いたメディア説明会に登壇した。講演では、報道陣の質問に答える形でサイバー攻撃とAIの関係性についても言及する一幕も。悪用の抑止に向けて同社がどう取り組むか、現在の方針も説明した。
[悪用確認] CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Atlassian Multiple Products Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-18)
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: >= 10.3.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108514 Description: The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to e…
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108515 Description: The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities…
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default Vulnerability: Remote code execution Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108097 Description: A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit p…
10月14日(水)
KotlinConf Recap: Lessons from Verifone’s Architect on Kotlin in Mission-Critical Payments
This article was written by an external contributor. Yuri Geronimus’s four-year-old son once asked him what his job was. Yuri told him he writes books: books that describe what he wants to change in the physical world. His son didn’t fully get it. Neither would most engineers: if you understand the words in your application […]
[悪用確認] CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-17)
[悪用確認] CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay AhsayCBS Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-17)
[悪用確認] CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco Secure Email Gateway Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-17)
[悪用確認] CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability
Ahsay AhsayCBS Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-17)
10月13日(火)
[悪用確認] CVE-2026-96951: Microsoft Windows Command Injection Vulnerability
Microsoft Windows Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-16)
[悪用確認] CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti Connect Secure Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-16)